{"uuid": "9a5346bf-1481-4854-9172-c7bfee928c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61560", "type": "seen", "source": "https://gist.github.com/alon710/53a2d29306b87115c0a5f70b93a57923", "content": "# CVE-2026-61560: CVE-2026-61560: Unauthenticated Remote Path Traversal and Access Token Exfiltration in @zereight/mcp-gitlab\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61560\n\n## Summary\nCVE-2026-61560 is a critical security vulnerability in the @zereight/mcp-gitlab Server-Sent Events (SSE) server. By utilizing default, unauthenticated route setups and exposing vulnerable administrative tools, remote attackers can execute path traversal attacks to read internal process variables and hijack GitLab operations.\n\n## TL;DR\nUnauthenticated remote attackers can read sensitive local container files and hijack GitLab accounts by abusing exposed Server-Sent Events endpoints and path traversal in the upload_markdown tool of @zereight/mcp-gitlab.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 / CWE-306\n- **Attack Vector**: Network\n- **CVSS Score**: 9.8\n- **EPSS Score**: 0.00703\n- **EPSS Percentile**: 51.56%\n- **Exploit Status**: PoC / Conceptual\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @zereight/mcp-gitlab\n- **@zereight/mcp-gitlab**: < 2.1.27 (Fixed in: `2.1.27`)\n\n## Mitigation\n\n- Enforce authentication on SSE transport by defining SSE_AUTH_TOKEN.\n- Bind the integration port exclusively to the local loopback interface (127.0.0.1).\n- Upgrade @zereight/mcp-gitlab to version 2.1.27 or higher.\n\n**Remediation Steps:**\n1. Verify the installed package version of @zereight/mcp-gitlab is 2.1.27 or higher.\n2. Configure the application host variable to HOST=127.0.0.1.\n3. Generate and apply a secure SSE_AUTH_TOKEN in the server environment variables.\n4. Review and rotate active GitLab Personal Access Tokens used by the deployment.\n\n## References\n\n- [GitHub Security Advisory GHSA-cv3r-c5h8-f4g5](https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5)\n- [Vulnerability Fix Commit](https://github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a2641c1976)\n- [NVD CVE-2026-61560 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-61560)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61560) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T21:32:23.216791Z"}